unit SetRights;

interface

uses
Windows, JclWin32;

function LsaAddAccountRights(PolicyHandle: LSA_HANDLE; AccountSid: PSID; UserRights: PLSA_UNICODE_STRING;
CountOfRights: ULONG): NTSTATUS; stdcall;
function LsaAddAccountRights; external advapi32 Name 'LsaAddAccountRights';

function AddPrivilegeToAccount(const AAccountName, APrivilege: string): DWORD;

implementation

const
STATUS_SUCCESS = 0;

function AddPrivilegeToAccount(const AAccountName, APrivilege: string): DWORD;
var
Status: NTSTATUS;
ObjectAttributes: TLsaObjectAttributes;
PolicyHandle: TLsaHandle;
Privilege: TLsaUnicodeString;
Sid: PSID;
SidLen: DWORD;
TmpDomain: string;
TmpDomainLen: DWORD;
TmpSidNameUse: TSidNameUse;
{$IFDEF UNICODE}
 PrivilegeWStr: String;
{$ELSE}
PrivilegeWStr: WideString;
{$ENDIF}
begin
ZeroMemory(@ObjectAttributes, SizeOf(ObjectAttributes));
Status := LsaOpenPolicy(nil, ObjectAttributes, POLICY_LOOKUP_NAMES, PolicyHandle);
if Status <> STATUS_SUCCESS then
begin
 Result := LsaNtStatusToWinError(Status);
 Exit;
end;
try
 TmpDomainLen := DNLEN; // In 'clear code' this should be get by LookupAccountName
 SetLength(TmpDomain, TmpDomainLen);

 SidLen := SECURITY_MAX_SID_SIZE;
 GetMem(Sid, SidLen);
 try
  if LookupAccountName(nil, PChar(AAccountName), Sid, SidLen, PChar(TmpDomain), TmpDomainLen,
   TmpSidNameUse) then
  begin
   PrivilegeWStr := APrivilege;

   Privilege.Buffer := PWideChar(PrivilegeWStr);
   Privilege.Length := Length(PrivilegeWStr) * SizeOf(char);
   Privilege.MaximumLength := Privilege.Length;

   Status := LsaAddAccountRights(PolicyHandle, Sid, @Privilege, 1);
   Result  := LsaNtStatusToWinError(Status);
  end else
   Result := GetLastError;
 finally
  FreeMem(Sid);
 end;
finally
 LsaClose(PolicyHandle);
end;
end;

end.